Save this for your future reference, or use it to map out how you would like to replace numbers in your IP and MAC addresses.ĥ. Do the same for IPv4, navigating to Statistics → Endpoints → IPv4, and copy-pasting the data into a document. With the filtered file still open in Wireshark, navigate to Statistics → Endpoints → Ethernet, select Copy in the bottom left hand corner, and paste into a secure document. If you run into problems later on, you’ll be flying blind. Otherwise, you won’t know which addresses refer to which device. This is a very important step, so don’t forget it! Before you scrub your pcaps, you will need to keep track of the real IPs and anonymized ones. To further srub the PCAP file of potential sensitive information use WireEdit. pcap files by going to File, then Export Specified Packets. Export the specified packets (all those displayed) as. Eliminating non-BACnet frames will reduce the size of the file and avoid holding sensitive information.ģ. This will filter for only BACnet packets. In the Filter bar in the top left side, filter “bacnet || bacapp || bvlc”. If you have already captured a pcap file, you can open it now.

Wireshark mac address filter example